@sideboard-ai/core 0.1.320 → 0.1.321

package/dist/index.js

@@ -46,6 +46,7 @@ import {
   connectedOrchestrator,
   connectedOrchestratorTurnReminder,
   consumeComposerAttachments,
+  createOrUpdatePr,
   createPrStack,
   createSchedule,
   createThread,
@@ -72,8 +73,10 @@ import {
   formatAskUserNotifyMessage,
   formatClaudeSubagentReminder,
   formatConnectedOrchestratorReminder,
+  formatCursorGitDirective,
   formatDetachedJobInvoke,
   formatDevAccessHint,
+  formatEntireGitDirective,
   formatFleetArchive,
   formatGitHubSearchUpdatedSince,
   formatInjectedNoticesForTurn,
@@ -98,6 +101,7 @@ import {
   getOrchestrator,
   getSchedule,
   getWorktreeDirtyStat,
+  ghPrCreateAssigneeArgs,
   groupHomeBoardWorktrees,
   hasEnabledSchedules,
   importConductorWorkspace,
@@ -206,7 +210,7 @@ import {
   worktreeCleanupSettings,
   writeAgentBlock,
   writeWorktreeFile
-} from "./chunk-IDPFLXRY.js";
+} from "./chunk-LD2DXHBP.js";
 import {
   LEGACY_PLAN_FILE_REL,
   PLAN_FILE_NAME,
@@ -296,7 +300,7 @@ import {
   userMcpNamesToDisable,
   worktreeMcpToolNames,
   writeInjectedMcpConfig
-} from "./chunk-LLIEU2ZB.js";
+} from "./chunk-JNEFEA2A.js";
 import {
   brightsyMcpServerName,
   connectBrightsyTeam,
@@ -306,7 +310,7 @@ import {
   listBrightsyAccounts,
   listConnectedBrightsyTeams,
   switchBrightsyAccount
-} from "./chunk-HH3VVTEC.js";
+} from "./chunk-S5CJUIPY.js";
 import {
   BRIGHTSY_SUMMARIZE_CONTEXT_TOOL,
   CHARS_PER_CONTEXT_TOKEN,
@@ -427,7 +431,7 @@ import {
   workspaceAgentChatSummaries,
   worktreeRunPortsPath,
   wrapReviewSkillMarkdown
-} from "./chunk-DJZRDTZY.js";
+} from "./chunk-BANN5HUX.js";
 import {
   STDERR_EVENT_MAX_CHARS,
   STDOUT_EVENT_MAX_CHARS,
@@ -549,7 +553,7 @@ import {
   detectOptionalServiceClis,
   installOptionalServiceCli,
   optionalCliPresence
-} from "./chunk-UK2KESBN.js";
+} from "./chunk-RHJKZOPQ.js";
 import {
   OPTIONAL_SERVICES,
   OPTIONAL_SERVICE_IDS,
@@ -565,7 +569,7 @@ import {
   optionalServiceConnected,
   optionalServiceSpec,
   verifyOptionalService
-} from "./chunk-EQ5JY3MJ.js";
+} from "./chunk-TEFFR6PB.js";
 import {
   getAgentSetupInfo,
   installAgent,
@@ -577,7 +581,7 @@ import {
   prepareTerminalCommand,
   resolveLoginCommand,
   whichOnPath
-} from "./chunk-CB5Z5C3J.js";
+} from "./chunk-BPDVHB4U.js";
 import {
   CLOUD_COORDINATOR_BUSY_REPLY,
   CLOUD_COORDINATOR_CANCELED_REPLY,
@@ -630,7 +634,7 @@ import {
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads,
   takenTeamSlugsForOrchestration
-} from "./chunk-RHJPP26T.js";
+} from "./chunk-H6GXYV5Q.js";
 import {
   GITHUB_PR_BODY_MAX_CHARS,
   GITHUB_PR_BODY_SAFE_CHARS,
@@ -649,12 +653,12 @@ import {
   connectedPrSelectors,
   countUnpushedVsOrigin,
   createExistingBranchWorktree,
-  createOrUpdatePr,
   createThreadWorktree,
   currentBranch,
   detectGhStack,
   detectLocalMergeConflicts,
   ensureGhPreferOrigin,
+  entireUsesTrails,
   extractGhErrorDetail,
   fastForwardMainCheckoutIfSafe,
   fetchOriginForWorktree,
@@ -671,7 +675,6 @@ import {
   getPrMeta,
   getPrStack,
   ghHeadRef,
-  ghPrCreateAssigneeArgs,
   ghRepoSelectArgs,
   githubAgentGitEnv,
   githubHttpsInsteadOfEntries,
@@ -707,8 +710,10 @@ import {
   resolveGithubAgentToken,
   resolveGithubRepoSlug,
   resolveListPrsOptions,
+  resolveOriginRemote,
   resolvePrSelector,
   resolvePrSelectors,
+  resolveProjectRemoteTag,
   resolveRepoRoot,
   resolveWorktreeStartPoint,
   scrubGithubTokensFromChildEnv,
@@ -718,7 +723,7 @@ import {
   suggestSlug,
   switchWorktreeBranch,
   warmGithubAgentAuth
-} from "./chunk-EDXTP2VR.js";
+} from "./chunk-UWJUARFA.js";
 import {
   FAMOUS_SOCCER_TEAMS,
   allocateTeamName,
@@ -745,6 +750,7 @@ import {
   updateThread,
   withThreadLock,
   workspaceNameLabel,
+  workspaceRowLabel,
   workspaceTagsFromGroup,
   worktreeAnchorLabel,
   worktreeDisplayLabel,
@@ -752,8 +758,8 @@ import {
   worktreeNameFromPath,
   worktreeSlugForTicket,
   writeThread
-} from "./chunk-4GZC6DDH.js";
-import "./chunk-2P4XKWV2.js";
+} from "./chunk-IFWGG2M2.js";
+import "./chunk-QKHEVSB5.js";
 import {
   BRIGHTSY_OAUTH_CLIENT_ID,
   BRIGHTSY_OAUTH_REDIRECT,
@@ -808,7 +814,7 @@ import {
   trustSystemCertificates,
   turnCostUsdFromCursorUsage,
   withMaxOldSpaceSize
-} from "./chunk-Y3Y7SZBZ.js";
+} from "./chunk-ZHGMRBSC.js";
 import "./chunk-5XNT6BCG.js";
 import {
   ATTACHMENTS_DIR,
@@ -829,13 +835,14 @@ import {
   isConductorBundledCli,
   npmGlobalNodeModules,
   npmGlobalPrefix,
+  originCli,
   posixShellSingleQuote,
   resolveCommandBinarySync,
   resolveGhAuthToken,
   resolveGitDirsForLockRecovery,
   run,
   withExportedPath
-} from "./chunk-QVN2WOKJ.js";
+} from "./chunk-2TUE6JKQ.js";
 import {
   AGENT_RPC_JOB_HOLD_MAX_MS,
   AGENT_RPC_JOB_SLICE_MS,
@@ -2716,7 +2723,7 @@ function listPhoneSidebar(viewerLogin = phoneViewerLogin()) {
       const badge = classifyWorktreeListBadges(group, viewerLogin, resolveProjectReviewLabel(settings, path2))[0];
       const blockedBy = issueBlockedByIds(group);
       return {
-        label: worktreeAnchorLabel(group).title,
+        ...workspaceRowLabel(group),
         chats: group.map(summarize),
         ...tags.length > 0 ? { tags } : {},
         ...blockedBy.length > 0 ? { blockedBy } : {},
@@ -3989,12 +3996,12 @@ async function persistLinearTokens(data, viewer) {
     organizationName: viewer?.organizationName
   });
 }
-async function fetchLinearViewer(accessToken2) {
+async function fetchLinearViewer(accessToken3) {
   const res = await httpFetch(LINEAR_GRAPHQL, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: linearAuthorizationHeader(accessToken2)
+      Authorization: linearAuthorizationHeader(accessToken3)
     },
     body: JSON.stringify({
       query: "{ viewer { name organization { name } } }"
@@ -5290,6 +5297,18 @@ async function validateLinearApiKey(apiKey) {
 }
 
 // src/integrations/issues.ts
+var CURSOR_ISSUES_UNAVAILABLE = "Cursor Origin has no issue tracker. Tickets for this repo come from Linear or AbleTime (Settings \u2192 Issues).";
+var ENTIRE_ISSUES_ARE_TRAILS = "Entire does not use GitHub Issues. Tickets for this repo are Trails (`entire trail list`). Linear or AbleTime still work when selected in Settings \u2192 Issues.";
+async function cursorIssuesUnavailableReason(repoPath) {
+  try {
+    const remote = await resolveOriginRemote(repoPath);
+    if (remote?.forge === "cursor") return CURSOR_ISSUES_UNAVAILABLE;
+    if (remote?.forge === "entire") return ENTIRE_ISSUES_ARE_TRAILS;
+    return null;
+  } catch {
+    return null;
+  }
+}
 function assigneeKey(assignee) {
   return (assignee ?? "").trim().toLowerCase();
 }
@@ -5451,6 +5470,17 @@ async function listIssues(repoPath, opts) {
       ...since ? { since, comments: commentsFromAbleTimeIssues(tasks, issues2, since) } : {}
     };
   }
+  const unavailableReason = await cursorIssuesUnavailableReason(repoPath);
+  if (unavailableReason) {
+    return {
+      source,
+      preferredSource,
+      linearConnected,
+      abletimeConnected,
+      issues: [],
+      unavailableReason
+    };
+  }
   const [issues, login] = await Promise.all([
     listGitHubIssues(repoPath, { assignee, query, limit: opts?.limit, updatedSince: since }),
     githubViewerLogin(repoPath)
@@ -7771,6 +7801,7 @@ import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, realpathSync }
 import { createRequire } from "module";
 import { dirname, join as join3 } from "path";
 var GITHUB_ACCOUNT_ISSUER = "https://github.com";
+var CURSOR_ACCOUNT_ISSUER = "https://api.cursor.com/v1/origin";
 var RELAY_DEVICE_CAP = 3;
 function thisModuleFile() {
   const cjsFile = typeof __filename !== "undefined" ? __filename : "";
@@ -8023,20 +8054,224 @@ var RelayAccountStore = class {
   }
 };
 
+// src/relay/account-cursor.ts
+import { createPublicKey, verify } from "crypto";
+var JWKS_URL = "https://api.cursor.com/v1/origin/keys";
+var RECEIPT_TYP = "origin-user-confirmation-receipt+jwt";
+var usedJti = /* @__PURE__ */ new Map();
+function b64urlJson(segment) {
+  return JSON.parse(b64urlBuf(segment).toString("utf8"));
+}
+function b64urlBuf(segment) {
+  const pad = segment.length % 4 === 0 ? "" : "=".repeat(4 - segment.length % 4);
+  return Buffer.from(segment.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+function rememberJti(jti, expMs, nowMs) {
+  for (const [id, exp] of usedJti) {
+    if (exp < nowMs) usedJti.delete(id);
+  }
+  if (usedJti.has(jti)) return false;
+  usedJti.set(jti, expMs);
+  return true;
+}
+function cursorAuthorizeUrl(clientId, redirectUri, state) {
+  const url = new URL("https://cursor.com/codebase/apps/user-confirmation");
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("state", state);
+  return url.toString();
+}
+async function cursorIdentityFromReceipt(receipt, expected, fetchImpl, nowMs = Date.now()) {
+  const parts = receipt.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {
+    throw new Error("Cursor sign-in receipt was not a signed token.");
+  }
+  const [hSeg, pSeg, sSeg] = parts;
+  const header = b64urlJson(hSeg);
+  if (header.alg !== "EdDSA" || header.typ !== RECEIPT_TYP || typeof header.kid !== "string") {
+    throw new Error("Cursor sign-in receipt was not a user confirmation.");
+  }
+  const payload = b64urlJson(pSeg);
+  if (payload.iss !== CURSOR_ACCOUNT_ISSUER) {
+    throw new Error("Cursor sign-in receipt came from an unexpected issuer.");
+  }
+  if (payload.aud !== expected.clientId) throw new Error("Cursor sign-in receipt was for a different app.");
+  if (payload.state !== expected.state) throw new Error("Cursor sign-in did not match this attempt.");
+  const exp = typeof payload.exp === "number" ? payload.exp : 0;
+  if (!exp || exp * 1e3 < nowMs) throw new Error("Cursor sign-in receipt expired.");
+  const sub = typeof payload.sub === "string" ? payload.sub.trim() : "";
+  if (!sub) throw new Error("Cursor did not return an account id.");
+  const jti = typeof payload.jti === "string" ? payload.jti.trim() : "";
+  if (!jti) throw new Error("Cursor sign-in receipt was missing an id.");
+  const jwksRes = await fetchImpl(JWKS_URL);
+  const body = await jwksRes.json();
+  const jwk = (body.keys ?? []).find(
+    (key2) => key2.kid === header.kid && key2.kty === "OKP" && key2.crv === "Ed25519" && key2.x
+  );
+  if (!jwk?.x) throw new Error("Cursor did not publish the key that signed this receipt.");
+  const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: jwk.x }, format: "jwk" });
+  const ok = verify(null, Buffer.from(`${hSeg}.${pSeg}`), key, b64urlBuf(sSeg));
+  if (!ok) throw new Error("Cursor sign-in receipt signature did not verify.");
+  if (!rememberJti(jti, exp * 1e3, nowMs)) throw new Error("Cursor sign-in receipt was already used.");
+  const email = typeof payload.email === "string" && payload.email.trim() ? payload.email.trim() : null;
+  return {
+    issuer: CURSOR_ACCOUNT_ISSUER,
+    subject: sub,
+    email,
+    emailVerified: Boolean(email)
+  };
+}
+function cursorGitHostEntry() {
+  return {
+    label: "Cursor",
+    requiresClientSecret: false,
+    credentialParam: "confirmation_receipt",
+    authorizeUrl(client, redirectUri, state) {
+      return cursorAuthorizeUrl(client.clientId, redirectUri, state);
+    },
+    fetchIdentity(client, receipt, _redirectUri, state, fetchImpl) {
+      return cursorIdentityFromReceipt(receipt, { clientId: client.clientId, state }, fetchImpl);
+    }
+  };
+}
+
+// src/relay/account-entire.ts
+import { createHash as createHash3, randomBytes as randomBytes6 } from "crypto";
+var ENTIRE_AUTHORIZE_ORIGIN = "https://auth.entire.io";
+var ENTIRE_DEFAULT_ISSUER = "https://us.auth.entire.io";
+var ISSUER_SUFFIX = ".auth.entire.io";
+function entireAccountIssuer(value) {
+  const raw = value?.trim() ?? "";
+  if (!raw) return null;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.port) return null;
+  if (url.pathname !== "/" && url.pathname !== "") return null;
+  if (url.search || url.hash) return null;
+  const host = url.hostname.toLowerCase();
+  if (!host.endsWith(ISSUER_SUFFIX)) return null;
+  const label = host.slice(0, -ISSUER_SUFFIX.length);
+  if (!/^[a-z0-9]+$/.test(label)) return null;
+  return `https://${host}`;
+}
+function newEntireCodeVerifier() {
+  return randomBytes6(32).toString("base64url");
+}
+function entireCodeChallenge(verifier) {
+  return createHash3("sha256").update(verifier).digest("base64url");
+}
+function entireAuthorizeUrl(clientId, redirectUri, state, codeChallenge) {
+  const url = new URL("/authorize", ENTIRE_AUTHORIZE_ORIGIN);
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", "openid email");
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+async function readJson(res) {
+  const text5 = await res.text();
+  if (!text5) return {};
+  try {
+    return JSON.parse(text5);
+  } catch {
+    throw new Error("Entire returned a non-JSON response.");
+  }
+}
+function accessToken(body) {
+  const token = body.access_token;
+  if (typeof token === "string" && token.trim()) return token.trim();
+  const described = body.error_description;
+  const code = body.error;
+  const message = typeof described === "string" && described.trim() ? described : code;
+  throw new Error(
+    typeof message === "string" && message.trim() ? message : "Entire rejected the sign-in code."
+  );
+}
+async function entireIdentityFromCode(client, code, redirectUri, ctx, fetchImpl) {
+  if (!ctx.codeVerifier) throw new Error("Entire sign-in could not be verified.");
+  const issuer = ctx.issuer?.trim() ? entireAccountIssuer(ctx.issuer) : ENTIRE_DEFAULT_ISSUER;
+  if (!issuer) throw new Error("Entire sign-in came from an unexpected issuer.");
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: client.clientId,
+    code_verifier: ctx.codeVerifier
+  });
+  const secret = client.clientSecret?.trim() ?? "";
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (secret) {
+    headers.Authorization = `Basic ${Buffer.from(`${client.clientId}:${secret}`).toString("base64")}`;
+  }
+  const tokenRes = await fetchImpl(`${issuer}/oauth/token`, {
+    method: "POST",
+    redirect: "error",
+    headers,
+    body
+  });
+  const token = accessToken(await readJson(tokenRes));
+  const userRes = await fetchImpl(`${issuer}/userinfo`, {
+    redirect: "error",
+    headers: { Accept: "application/json", Authorization: `Bearer ${token}` }
+  });
+  if (!userRes.ok) throw new Error("Entire did not return an account.");
+  const user = await readJson(userRes);
+  const subject = typeof user.sub === "string" ? user.sub.trim() : "";
+  if (!subject) throw new Error("Entire did not return an account id.");
+  const email = typeof user.email === "string" ? user.email.trim() : "";
+  const emailVerified = user.email_verified === true && Boolean(email);
+  return {
+    issuer,
+    subject,
+    email: emailVerified ? email : null,
+    emailVerified
+  };
+}
+function entireGitHostEntry() {
+  return {
+    label: "Entire",
+    requiresClientSecret: false,
+    credentialParam: "code",
+    authorizeUrl(client, redirectUri, state, ctx) {
+      if (!ctx.codeVerifier) throw new Error("Entire sign-in could not start.");
+      return entireAuthorizeUrl(client.clientId, redirectUri, state, entireCodeChallenge(ctx.codeVerifier));
+    },
+    fetchIdentity(client, code, redirectUri, _state, fetchImpl, ctx) {
+      return entireIdentityFromCode(client, code, redirectUri, ctx, fetchImpl);
+    }
+  };
+}
+
 // src/relay/account-oauth.ts
-var RELAY_GIT_HOSTS = ["github"];
+var RELAY_GIT_HOSTS = ["github", "cursor", "entire"];
 var REMOTE_LOGIN_PATH = "/remote/login";
 var REMOTE_OAUTH_CALLBACK_PATH = "/remote/oauth/callback";
 var REMOTE_OAUTH_RESULT_PATH = "/remote/oauth/result";
 var REMOTE_LOGOUT_PATH = "/remote/logout";
 var STATE_RE = /^[A-Za-z0-9_-]{16,128}$/;
 var LOGIN_TTL_MS = 10 * 60 * 1e3;
+var EMPTY_AUTH = { codeVerifier: null, issuer: null };
 var RelayLoginSessions = class {
   waiting = /* @__PURE__ */ new Map();
   results = /* @__PURE__ */ new Map();
-  begin(state, provider, accountId) {
+  begin(state, provider, accountId, codeVerifier = null) {
     this.sweep();
-    this.waiting.set(state, { provider, accountId, expiresAt: Date.now() + LOGIN_TTL_MS });
+    this.waiting.set(state, {
+      provider,
+      accountId,
+      codeVerifier,
+      expiresAt: Date.now() + LOGIN_TTL_MS
+    });
   }
   takeLogin(state) {
     this.sweep();
@@ -8071,24 +8306,29 @@ var RelayLoginSessions = class {
 var GIT_HOST_AUTH = {
   github: {
     label: "GitHub",
-    authorizeUrl: "https://github.com/login/oauth/authorize",
-    scope: "user:email",
+    requiresClientSecret: true,
+    credentialParam: "code",
+    authorizeUrl: (client, redirectUri, state) => githubAuthorizeUrl(client, redirectUri, state),
     fetchIdentity: fetchGithubIdentity
-  }
+  },
+  cursor: cursorGitHostEntry(),
+  entire: entireGitHostEntry()
 };
-function providerOf(value) {
-  return RELAY_GIT_HOSTS.includes(value) ? value : null;
-}
-function relayAuthorizeUrl(provider, client, redirectUri, state) {
-  const host = GIT_HOST_AUTH[provider];
-  const url = new URL(host.authorizeUrl);
+function githubAuthorizeUrl(client, redirectUri, state) {
+  const url = new URL("https://github.com/login/oauth/authorize");
   url.searchParams.set("client_id", client.clientId);
   url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", host.scope);
+  url.searchParams.set("scope", "user:email");
   url.searchParams.set("state", state);
   return url.toString();
 }
-async function readJson(res) {
+function providerOf(value) {
+  return RELAY_GIT_HOSTS.includes(value) ? value : null;
+}
+function relayAuthorizeUrl(provider, client, redirectUri, state, ctx = EMPTY_AUTH) {
+  return GIT_HOST_AUTH[provider].authorizeUrl(client, redirectUri, state, ctx);
+}
+async function readJson2(res) {
   const text5 = await res.text();
   if (!text5) return {};
   try {
@@ -8097,7 +8337,7 @@ async function readJson(res) {
     throw new Error("Sign-in provider returned a non-JSON response.");
   }
 }
-function accessToken(body) {
+function accessToken2(body) {
   const token = body.access_token;
   if (typeof token !== "string" || !token.trim()) {
     const message = body.error_description;
@@ -8105,7 +8345,10 @@ function accessToken(body) {
   }
   return token.trim();
 }
-async function fetchGithubIdentity(client, code, redirectUri, fetchImpl) {
+async function fetchGithubIdentity(client, code, redirectUri, state, fetchImpl, _ctx) {
+  void state;
+  void _ctx;
+  if (!client.clientSecret) throw new Error("GitHub sign-in is not configured on this relay.");
   const tokenRes = await fetchImpl("https://github.com/login/oauth/access_token", {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/json" },
@@ -8116,17 +8359,17 @@ async function fetchGithubIdentity(client, code, redirectUri, fetchImpl) {
       redirect_uri: redirectUri
     })
   });
-  const token = accessToken(await readJson(tokenRes));
+  const token = accessToken2(await readJson2(tokenRes));
   const userRes = await fetchImpl("https://api.github.com/user", {
     headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "User-Agent": "sideboard-relay" }
   });
-  const user = await readJson(userRes);
+  const user = await readJson2(userRes);
   const subject = typeof user.id === "number" ? String(user.id) : "";
   if (!subject) throw new Error("GitHub did not return an account id.");
   const emailRes = await fetchImpl("https://api.github.com/user/emails", {
     headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "User-Agent": "sideboard-relay" }
   });
-  const emails = await readJson(emailRes);
+  const emails = await readJson2(emailRes);
   const list = Array.isArray(emails) ? emails : [];
   const primary = list.find((row2) => row2.primary === true && row2.verified === true);
   const anyVerified = list.find((row2) => row2.verified === true);
@@ -8134,8 +8377,8 @@ async function fetchGithubIdentity(client, code, redirectUri, fetchImpl) {
   const email = chosen && typeof chosen.email === "string" ? chosen.email : null;
   return { issuer: GITHUB_ACCOUNT_ISSUER, subject, email, emailVerified: Boolean(email) };
 }
-async function fetchRelayIdentity(provider, client, code, redirectUri, fetchImpl) {
-  return GIT_HOST_AUTH[provider].fetchIdentity(client, code, redirectUri, fetchImpl);
+async function fetchRelayIdentity(provider, client, credential, redirectUri, state, fetchImpl, ctx = EMPTY_AUTH) {
+  return GIT_HOST_AUTH[provider].fetchIdentity(client, credential, redirectUri, state, fetchImpl, ctx);
 }
 async function readBody(req) {
   const chunks = [];
@@ -8245,7 +8488,8 @@ async function handleRelayAccountHttp(opts) {
       return true;
     }
     const client = opts.oauth[provider];
-    if (!client?.clientId || !client.clientSecret) {
+    const host = provider ? GIT_HOST_AUTH[provider] : null;
+    if (!client?.clientId || host?.requiresClientSecret && !client.clientSecret) {
       sendJson(opts.res, 503, {
         ok: false,
         error: `${GIT_HOST_AUTH[provider].label} sign-in is not configured on this relay.`
@@ -8261,21 +8505,26 @@ async function handleRelayAccountHttp(opts) {
         return true;
       }
     }
-    opts.sessions.begin(state, provider, accountId);
-    sendJson(opts.res, 200, { ok: true, url: relayAuthorizeUrl(provider, client, redirectUri, state) });
+    const codeVerifier = provider === "entire" ? newEntireCodeVerifier() : null;
+    const auth = { codeVerifier, issuer: null };
+    opts.sessions.begin(state, provider, accountId, codeVerifier);
+    sendJson(opts.res, 200, {
+      ok: true,
+      url: relayAuthorizeUrl(provider, client, redirectUri, state, auth)
+    });
     return true;
   }
   if (method === "GET" && path2 === REMOTE_OAUTH_CALLBACK_PATH) {
     const url = new URL(reqUrl, origin);
     const state = url.searchParams.get("state")?.trim() ?? "";
-    const code = url.searchParams.get("code")?.trim() ?? "";
     const providerError = url.searchParams.get("error")?.trim() ?? "";
     const pending = STATE_RE.test(state) ? opts.sessions.takeLogin(state) : null;
     if (!pending) {
       sendHtml(opts.res, 400, "Sideboard", "<h1>Sign-in expired</h1><p>Return to Sideboard and try again.</p>");
       return true;
     }
-    if (providerError || !code) {
+    const credential = url.searchParams.get(GIT_HOST_AUTH[pending.provider].credentialParam)?.trim() ?? "";
+    if (providerError || !credential) {
       const message = providerError || "Sign-in was cancelled.";
       opts.sessions.putResult(state, { ok: false, error: message });
       sendHtml(opts.res, 400, "Sideboard", `<h1>Could not sign in</h1><p>${escapeHtml(message)}</p>`);
@@ -8288,7 +8537,15 @@ async function handleRelayAccountHttp(opts) {
       return true;
     }
     try {
-      const identity = await fetchRelayIdentity(pending.provider, client, code, redirectUri, fetchImpl);
+      const identity = await fetchRelayIdentity(
+        pending.provider,
+        client,
+        credential,
+        redirectUri,
+        state,
+        fetchImpl,
+        { codeVerifier: pending.codeVerifier, issuer: url.searchParams.get("iss") }
+      );
       const signed = opts.store.signIn(identity, pending.accountId);
       opts.sessions.putResult(state, {
         ok: true,
@@ -8757,7 +9014,7 @@ async function startHeadlessHost(opts) {
   };
   const refreshRunning = async () => {
     try {
-      const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-NPFWU3XU.js");
+      const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-B4STIW4B.js");
       agentsRunning = getOrchestrator2().getRuntime().running;
     } catch {
       agentsRunning = 0;
@@ -8835,6 +9092,128 @@ function flatInterfaces() {
   return out;
 }
 
+// src/integrations/cursor-git.ts
+function parseOriginAuthStatus(text5) {
+  const account = text5.match(/^Account:\s+(.+)$/m)?.[1]?.trim() || null;
+  const authMethod = text5.match(/^Auth method:\s+(.+)$/m)?.[1]?.trim() || null;
+  return { account, authMethod };
+}
+async function getCursorGitStatus() {
+  const which = await run("which", ["origin"], { reject: false, timeoutMs: 5e3 });
+  if (which.exitCode !== 0 || !which.stdout.trim()) {
+    return {
+      installed: false,
+      connected: false,
+      account: null,
+      authMethod: null,
+      reason: "origin CLI not found on PATH"
+    };
+  }
+  const status = await run("origin", ["auth", "status"], { reject: false, timeoutMs: 15e3 });
+  const text5 = `${status.stdout}
+${status.stderr}`;
+  const parsed = parseOriginAuthStatus(text5);
+  if (status.exitCode === 0 && parsed.account) {
+    return {
+      installed: true,
+      connected: true,
+      account: parsed.account,
+      authMethod: parsed.authMethod,
+      reason: null
+    };
+  }
+  return {
+    installed: true,
+    connected: false,
+    account: null,
+    authMethod: null,
+    reason: status.stderr.trim() || status.stdout.trim() || "Not signed in to Cursor (Settings \u2192 Git \u2192 Cursor, or origin auth login)"
+  };
+}
+async function loginCursorGit() {
+  const status = await getCursorGitStatus();
+  if (!status.installed) {
+    return { ok: false, message: status.reason || "origin CLI not found on PATH" };
+  }
+  await openInSystemTerminal("origin auth login");
+  return {
+    ok: true,
+    openedTerminal: true,
+    command: "origin auth login",
+    message: "Opened Terminal to run: origin auth login"
+  };
+}
+async function setupCursorGit() {
+  const status = await getCursorGitStatus();
+  if (!status.installed) {
+    return { ok: false, message: status.reason || "origin CLI not found on PATH" };
+  }
+  const result = await run("origin", ["auth", "setup-git"], {
+    reject: false,
+    timeoutMs: 2e4
+  });
+  const message = result.stdout.trim() || result.stderr.trim() || (result.exitCode === 0 ? "Git is configured to authenticate Origin through the origin CLI." : "origin auth setup-git failed");
+  return {
+    ok: result.exitCode === 0,
+    command: "origin auth setup-git",
+    message,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    exitCode: result.exitCode
+  };
+}
+
+// src/integrations/entire-git.ts
+function parseEntireAuthContexts(text5) {
+  for (const line of text5.split("\n")) {
+    if (!/\(active\)/i.test(line)) continue;
+    const cols = line.replace(/\(active\)/gi, "").trim().split(/\s{2,}/).map((part) => part.trim()).filter(Boolean);
+    const handle = cols[1] || cols[0] || null;
+    if (handle && !/^context$/i.test(handle)) return { account: handle };
+  }
+  return { account: null };
+}
+async function getEntireGitStatus() {
+  const which = await run("which", ["entire"], { reject: false, timeoutMs: 5e3 });
+  if (which.exitCode !== 0 || !which.stdout.trim()) {
+    return {
+      installed: false,
+      connected: false,
+      account: null,
+      reason: "entire CLI not found on PATH"
+    };
+  }
+  const status = await run("entire", ["auth", "contexts"], { reject: false, timeoutMs: 15e3 });
+  const parsed = parseEntireAuthContexts(status.stdout);
+  if (status.exitCode === 0 && parsed.account) {
+    return {
+      installed: true,
+      connected: true,
+      account: parsed.account,
+      reason: null
+    };
+  }
+  return {
+    installed: true,
+    connected: false,
+    account: null,
+    reason: status.stderr.trim() || "Not signed in to Entire (Settings \u2192 Git \u2192 Entire, or entire login)"
+  };
+}
+async function loginEntireGit() {
+  const status = await getEntireGitStatus();
+  if (!status.installed) {
+    return { ok: false, message: status.reason || "entire CLI not found on PATH" };
+  }
+  await openInSystemTerminal("entire login");
+  return {
+    ok: true,
+    openedTerminal: true,
+    command: "entire login",
+    message: "Opened Terminal to run: entire login"
+  };
+}
+
 // src/composer/diff-comment.ts
 function lineRangeLabel(lines) {
   const nos = lines.map((l) => l.lineNo);
@@ -9723,11 +10102,15 @@ function fail2(err) {
     true
   );
 }
+async function cursorIssueBlock(repoPath) {
+  const cwd = await resolveRepoRoot((repoPath ?? "").trim() || process.cwd());
+  return cursorIssuesUnavailableReason(cwd);
+}
 var repoPathSchema = z3.string().optional().describe("Workspace / worktree path. Omit on a worktree turn (uses cwd).");
 function registerGithubIssueTools(server) {
   server.tool(
     "github_search_issues",
-    "Search or list open GitHub issues in this repo via Account gh. Default 40; pass query and/or limit (max 250) when truncated. assignee: me, unassigned, all, or a login. Pass updatedSince for new/updated tickets and new comments (e.g. \u201Cany updates since yesterday?\u201D).",
+    "Search or list open GitHub issues in this repo via Account gh. A Cursor origin returns unavailableReason \u2014 Origin has no issue tracker. An Entire origin does the same \u2014 tickets there are Trails (`entire trail`), not GitHub Issues. Default 40; pass query and/or limit (max 250) when truncated. assignee: me, unassigned, all, or a login. Pass updatedSince for new/updated tickets and new comments (e.g. \u201Cany updates since yesterday?\u201D).",
     {
       query: z3.string().optional().describe("Search text (title, body, identifiers). Omit to list by assignee only."),
       assignee: z3.string().optional().describe("me, unassigned, all, or a GitHub login. Default: all when query is set, otherwise me."),
@@ -9739,6 +10122,15 @@ function registerGithubIssueTools(server) {
       try {
         const cwd = await resolveRepoRoot((repoPath ?? "").trim() || process.cwd());
         const page = clampMcpIssueLimit(limit);
+        const blocked = await cursorIssuesUnavailableReason(cwd);
+        if (blocked) {
+          return mcpJson(
+            formatListedIssuesForMcp(
+              { source: "github", issues: [], unavailableReason: blocked },
+              page
+            )
+          );
+        }
         const since = updatedSince ? parseIssueSince(updatedSince) : void 0;
         const issues = await listGitHubIssues(cwd, {
           query,
@@ -9774,6 +10166,8 @@ function registerGithubIssueTools(server) {
     { repoPath: repoPathSchema },
     async ({ repoPath }) => {
       try {
+        const blocked = await cursorIssueBlock(repoPath);
+        if (blocked) throw new Error(blocked);
         return text2({ projects: await listGitHubProjects({ repoPath }) });
       } catch (err) {
         return fail2(err);
@@ -9786,6 +10180,8 @@ function registerGithubIssueTools(server) {
     { id: z3.string(), include: mcpIssueIncludeSchema, repoPath: repoPathSchema },
     async ({ id, include, repoPath }) => {
       try {
+        const blocked = await cursorIssueBlock(repoPath);
+        if (blocked) throw new Error(blocked);
         return text2(formatGitHubIssuePayload(await getGitHubIssue(id, { repoPath }), include));
       } catch (err) {
         return fail2(err);
@@ -9814,6 +10210,8 @@ function registerGithubIssueTools(server) {
     { id: z3.string(), body: z3.string(), repoPath: repoPathSchema },
     async ({ id, body, repoPath }) => {
       try {
+        const blocked = await cursorIssueBlock(repoPath);
+        if (blocked) throw new Error(blocked);
         return text2(await commentGitHubIssue({ id, body }, { repoPath }));
       } catch (err) {
         return fail2(err);
@@ -9841,6 +10239,8 @@ function registerGithubIssueTools(server) {
     },
     async (args) => {
       try {
+        const blocked = await cursorIssueBlock(args.repoPath);
+        if (blocked) throw new Error(blocked);
         return text2(await updateGitHubIssue(args, { repoPath: args.repoPath }));
       } catch (err) {
         return fail2(err);
@@ -9858,6 +10258,8 @@ function registerGithubIssueTools(server) {
     },
     async (args) => {
       try {
+        const blocked = await cursorIssueBlock(args.repoPath);
+        if (blocked) throw new Error(blocked);
         return text2(await createGitHubIssue(args, { repoPath: args.repoPath }));
       } catch (err) {
         return fail2(err);
@@ -10690,7 +11092,7 @@ async function handleJobStop(params, _ctx) {
   return stopDetachedJob(jobCwd(rec), id, reason ? { reason } : void 0);
 }
 async function defaultTurnWait(ref, timeoutMs) {
-  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-NPFWU3XU.js");
+  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-B4STIW4B.js");
   const orch = getOrchestrator2();
   const thread = await orch.waitForTurn(ref, timeoutMs, {
     resolveIfStillRunning: true
@@ -11078,13 +11480,13 @@ async function startMcpServer() {
   if (!worktreeProfile) {
     server.tool(
       "list_projects",
-      "List registered projects (git repos). Each line is name, path, github:owner/repo when resolvable, and project context when set \u2014 use path as repoPath for list_board/list_branches/list_prs/list_issues/create_workspace. Account / project context (Settings \u2192 Agents / Projects) says which tickets and review PRs belong to the user.",
+      "List registered projects (git repos). Each line is name, path, that repo's origin as host:owner/repo (github:, cursor:, entire:, or another hostname), and project context when set. Projects do not share one git host. Use path as repoPath for list_board/list_branches/list_prs/list_issues/create_workspace. Account / project context (Settings \u2192 Agents / Projects) says which tickets and review PRs belong to the user.",
       {},
       async () => {
         const workspaces = orch.listWorkspaces();
         const lines = await Promise.all(
           workspaces.map(async (w) => {
-            const slug = await resolveGithubRepoSlug(w.path).catch(() => null);
+            const tag = await resolveProjectRemoteTag(w.path).catch(() => null);
             let profile;
             try {
               profile = resolveViewerProfileForRepo(w.path);
@@ -11092,7 +11494,7 @@ async function startMcpServer() {
               profile = resolveViewerProfile();
             }
             const suffix = formatWorkspaceProfileSuffix(profile);
-            return slug ? `${w.name}  ${w.path}  github:${slug}${suffix}` : `${w.name}  ${w.path}${suffix}`;
+            return tag ? `${w.name}  ${w.path}  ${tag}${suffix}` : `${w.name}  ${w.path}${suffix}`;
           })
         );
         return {
@@ -11939,7 +12341,7 @@ async function startMcpServer() {
               error: true,
               action,
               lastError: message,
-              hint: /body is too long/i.test(message) ? "Branch is already pushed. send_to_chat so the worktree agent runs gh pr create --draft --assignee @me -R <origin> --body-file <short.md>. Keep the description short." : void 0
+              hint: /body is too long/i.test(message) ? "Branch is already pushed. send_to_chat so the worktree agent retries with a short body (GitHub: gh pr create --draft --assignee @me -R <slug>; Cursor: origin pr create --draft --push -R <slug>; Entire: entire trail create --title with a short --body). Keep the description short." : void 0
             },
             true
           );
@@ -12249,7 +12651,7 @@ async function startMcpServer() {
     );
     server.tool(
       "list_issues",
-      "List or search issues (Linear, AbleTime, or GitHub; falls back to GitHub). Use Settings \u2192 Agents / Projects notes and roles to pick tickets relevant to the viewer (query + assignee=me or unassigned as the notes say). Default 40; pass query and/or limit (max 250) when truncated. assignee: me (Linear default), unassigned, all, or a user id. Pass updatedSince for new/updated tickets and new comments (\u201Cany updates since yesterday?\u201D). Then create_workspace with sourceType=ticket.",
+      "List or search issues (Linear, AbleTime, or GitHub; falls back to GitHub). Cursor Origin has no issue tracker \u2014 a Cursor repo returns unavailableReason unless Linear or AbleTime is the source. Entire tickets are Trails (`entire trail`), not GitHub Issues, so an Entire repo does the same unless Linear or AbleTime is the source. Use Settings \u2192 Agents / Projects notes and roles to pick tickets relevant to the viewer (query + assignee=me or unassigned as the notes say). Default 40; pass query and/or limit (max 250) when truncated. assignee: me (Linear default), unassigned, all, or a user id. Pass updatedSince for new/updated tickets and new comments (\u201Cany updates since yesterday?\u201D). Then create_workspace with sourceType=ticket.",
       {
         repoPath: z8.string(),
         query: z8.string().optional().describe("Search title, identifier, or description"),
@@ -12275,7 +12677,7 @@ async function startMcpServer() {
 }
 
 // src/agent-rpc/server.ts
-import { randomBytes as randomBytes6, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes as randomBytes7, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { createServer as createServer3 } from "http";
 import { WebSocketServer as WebSocketServer2 } from "ws";
 function tokensEqual(a, b) {
@@ -12315,7 +12717,7 @@ var AgentRpcServer = class {
   async listen(opts = {}) {
     const host = opts.host ?? "127.0.0.1";
     const port = opts.port ?? 0;
-    const authToken = randomBytes6(24).toString("base64url");
+    const authToken = randomBytes7(24).toString("base64url");
     this.meta = {
       runtimeId: randomUUID8(),
       pid: process.pid,
@@ -13168,7 +13570,7 @@ function slackTokenFor(ws, kind = "read") {
 }
 
 // src/slack/oauth.ts
-import { randomBytes as randomBytes7 } from "crypto";
+import { randomBytes as randomBytes8 } from "crypto";
 var SLACK_BOT_SCOPES = [
   "app_mentions:read",
   "channels:history",
@@ -13261,7 +13663,7 @@ async function startSlackOAuth(opts) {
     throw new SlackOAuthCancelledError();
   }
   const { clientId } = slackOAuthCredentials();
-  const state = randomBytes7(16).toString("hex");
+  const state = randomBytes8(16).toString("hex");
   const authorizeUrl = slackOAuthAuthorizeUrl(clientId, state);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
   const pollIntervalMs = opts?.pollIntervalMs ?? 400;
@@ -14154,7 +14556,7 @@ function resolveSlackListenMode(opts) {
 }
 
 // src/relay/account-login.ts
-import { randomBytes as randomBytes8 } from "crypto";
+import { randomBytes as randomBytes9 } from "crypto";
 var RemoteAccountLoginCancelled = class extends Error {
   constructor() {
     super("Sign-in cancelled");
@@ -14207,7 +14609,7 @@ async function relayFetch(fetchImpl, url, init) {
     throw relayFetchError(err, url);
   }
 }
-async function readJson2(res, url) {
+async function readJson3(res, url) {
   try {
     return await res.json();
   } catch {
@@ -14220,7 +14622,7 @@ async function readJson2(res, url) {
 async function startRemoteAccountLogin(opts) {
   if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
   const origin = (opts.origin ?? remoteAccountHttpOrigin()).replace(/\/+$/, "");
-  const state = randomBytes8(16).toString("hex");
+  const state = randomBytes9(16).toString("hex");
   const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 400;
   const linkToken = opts.linkToken?.trim() ?? "";
@@ -14234,7 +14636,7 @@ async function startRemoteAccountLogin(opts) {
       ...linkToken ? { accountToken: linkToken } : {}
     })
   });
-  const startBody = await readJson2(started, startUrl);
+  const startBody = await readJson3(started, startUrl);
   if (!started.ok || !startBody.url) {
     throw new Error(startBody.error || `Could not start sign-in (HTTP ${started.status}).`);
   }
@@ -14358,7 +14760,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-NPFWU3XU.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-B4STIW4B.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -14672,12 +15074,14 @@ export {
   CONTEXT_REVIEW_PATH,
   CONVENTION_SETUP_RELPATHS,
   COORDINATOR_TOOL_PLAYBOOK,
+  CURSOR_ISSUES_UNAVAILABLE,
   CURSOR_SDK_INSTALL_HINT,
   DEFAULT_ABLETIME_HOST,
   DEFAULT_RUN_LOG_TAIL_CHARS,
   DEFAULT_WORKTREE_SORT,
   DETACHED_JOBS_DIR,
   EMPTY_MANAGED_ACCOUNTS,
+  ENTIRE_ISSUES_ARE_TRAILS,
   FAMOUS_SOCCER_TEAMS,
   FOLLOW_UP_BEHAVIORS,
   GITHUB_GIT_AUTH_MODES,
@@ -14945,6 +15349,7 @@ export {
   createThreadWorktree,
   currentBranch,
   cursorAdapter,
+  cursorIssuesUnavailableReason,
   cursorSdkMessageToEvents,
   decodeBrightsyTarget,
   defaultScheduleName,
@@ -14994,6 +15399,7 @@ export {
   ensureSlackCoordinator,
   ensureSlackDeviceIdentity,
   ensureWorkspace,
+  entireUsesTrails,
   estimateMessageChars,
   estimateOccupancyTokens,
   estimateThreadChars,
@@ -15044,8 +15450,10 @@ export {
   formatClaudeUsageTooltip,
   formatCloudTurnReply,
   formatConnectedOrchestratorReminder,
+  formatCursorGitDirective,
   formatDetachedJobInvoke,
   formatDevAccessHint,
+  formatEntireGitDirective,
   formatFetchError,
   formatGhLandError,
   formatGitAuthModeDirective,
@@ -15102,6 +15510,7 @@ export {
   getBrightsySession,
   getCaffeinateHold,
   getClaudePlanUsage,
+  getCursorGitStatus,
   getDefaultAgent,
   getDefaultAutonomy,
   getDefaultEffort,
@@ -15110,6 +15519,7 @@ export {
   getDefaultRunScript,
   getDiff,
   getDiffSummary,
+  getEntireGitStatus,
   getGitHubIssue,
   getGitHubStatus,
   getGithubGitAuthMode,
@@ -15327,6 +15737,8 @@ export {
   localhostPreviewUrl,
   locksDir,
   loginAgent,
+  loginCursorGit,
+  loginEntireGit,
   loginEnvPrefix,
   loginManagedAccount,
   looksLikeComposerSkillExpansion,
@@ -15393,6 +15805,7 @@ export {
   orchestrationQuotaOnLimit,
   orchestrationTitleNeedsSoccerNickname,
   orchestratorSessionPoisonedByBuiltins,
+  originCli,
   originFetchBranch,
   originGhRepoEnv,
   outboundReplyFromTurn,
@@ -15403,11 +15816,13 @@ export {
   parseCursorRunnerLine,
   parseDevPreview,
   parseDurationMs,
+  parseEntireAuthContexts,
   parseForceStopMessage,
   parseGhStackViewJson,
   parseGitHubIssueNumber,
   parseGithubSlugFromRemoteUrl,
   parseMcpList,
+  parseOriginAuthStatus,
   parsePlanQuestionsInput,
   parsePrDetailsView,
   parseSessionQuotaResetAt,
@@ -15510,9 +15925,11 @@ export {
   resolveNewThreadOptions,
   resolveOrchChildFollowUp,
   resolveOrchestratorDefaults,
+  resolveOriginRemote,
   resolvePlanMarkdown,
   resolvePrSelector,
   resolvePrSelectors,
+  resolveProjectRemoteTag,
   resolveProjectReviewLabel,
   resolveQuotaFallbackAgent,
   resolveRepoRoot,
@@ -15563,6 +15980,7 @@ export {
   setStatus,
   setVaultMasterKey,
   settingsSourceLabel,
+  setupCursorGit,
   shiftQueuedItem,
   shouldAttachPastedText,
   shouldCompactContext,